Domain permissions

Question

Hi all

i have a requirement from one of my user to provide Read permission on the Deleted Objects Container.
I have logged into one of my DC. Opened Active Directory users and computers-enabled Advanced features-Right click on the domain-properties-Security
Added the user but i dont see Read permission on the Deleted Objects Container.
Do we have this permission on the domain level. please guide me

Answer 1

Hi,

I think you need to review this and the best practice is not to delegate (assign) permissions directly to specific user accounts. Create a new security group in AD instead, add a user to it, and delegate permissions on an OU or Domain for that group. If you want to grant the same permissions to another user, you can simply add him to this security group.

However in this case you can try this command:

dsacls "CN=Deleted Objects,DC=Picaso,DC=com" /g Picaso\Bloggs:LCRP

In this example, the user "Picaso\bloggs" has been granted List Contents and Read Property permissions on the deleted objects container in the "Picaso" domain.

ACLDiag.exe "CN=Deleted Objects,DC=Picaso,DC=com" /chkdeleg (for checking the permission)

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi @Glenn Maxwell

Have a look at this post which explains how to delegate the restore of deleted objects. Steps 3 and 4 cover how to delegate list rights to the deleted objects container.

https://nettools.net/how-to-delegate-object-restoration-rights/

Gary.